{"id":"CVE-2025-69723","title":"A reflected cross-site scripting (XSS) vulnerability in localstack v4.9.2 allows attackers to execute arbitrary Javascript in the context of the user's browser via a crafted URL.","summary":"A reflected cross-site scripting (XSS) vulnerability in localstack v4.9.2 allows attackers to execute arbitrary Javascript in the context of the user's browser via a crafted URL.","severity":"medium","cvss":6.1,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","cvssSource":"adp","ssvc":{"exploitation":"poc","automatable":"no","technicalImpact":"partial","timestamp":"2026-10-26T19:09:15.954458Z"},"exploitAvailable":true,"published":"2026-10-22","updated":"2026-10-26","sourceUpdated":"2026-10-26T19:39:56.898Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2025-69723","references":[{"url":"https://cyberroute.github.io/post/2025-12-11-localstack-hack/"}],"tags":["cve.org","exploit-available"],"epss":0.0023,"epssPercentile":0.13716,"ingestedAt":"2026-10-22T22:00:50.363Z","slug":"CVE-2025-69723","body":"## Overview\n\nA reflected cross-site scripting (XSS) vulnerability in localstack v4.9.2 allows attackers to execute arbitrary Javascript in the context of the user's browser via a crafted URL.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":46,"depthScoreParts":{"impact":33.6,"likelihood":0,"exploitation":12,"ransomware":0},"changes":[{"seq":229787,"id":"CVE-2025-69723","ts":1793047369724,"field":"exploit_available","old":"false","new":"true"},{"seq":229786,"id":"CVE-2025-69723","ts":1793047369724,"field":"cvss","old":null,"new":"6.1"},{"seq":229785,"id":"CVE-2025-69723","ts":1793047369724,"field":"severity","old":"none","new":"medium"}]}